Registries & Tagging Discipline

Moving Images Around

Images travel between machines through a registry - Docker Hub, GitHub Container Registry (ghcr.io), AWS ECR, or one you run yourself:

$ docker run -d --name registry -p 5000:5000 registry:2   # your own registry!
$ docker tag  inventory:1.0  localhost:5000/inventory:1.0
$ docker push localhost:5000/inventory:1.0
$ curl http://localhost:5000/v2/_catalog
{"repositories":["inventory"]}

Note: docker tag doesn't copy anything - it adds another name pointing at the same image. The registry prefix in the name tells docker push where to send it.

Tagging discipline for real teams:

Tag	Use
`myapp:git-3f2a91c`	immutable - exactly one build, forever
`myapp:1.4.2`	release version (semver)
`myapp:latest`	convenience only - never in production manifests

Scenario: 2 AM incident: "roll back to yesterday's version." If your deploys are tagged latest, yesterday's image is gone - overwritten. If they're tagged by version or commit, rollback is a one-line change. Tag discipline is an incident-response feature.

Goal: The Private Registry lab has you run registry:2, tag, push, and verify via the registry HTTP API - exactly what CI systems do.